{"record":{"id":"6ffed13954d00083","repo":"BerriAI/litellm","slug":"invalid-langfuse-endpoint-path","errorCode":null,"errorMessage":"Invalid Langfuse endpoint path","messagePattern":"Invalid Langfuse endpoint path","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/vertex_ai_endpoints/langfuse_endpoints.py","lineNumber":85,"sourceCode":"    if base_url.scheme not in (\"http\", \"https\") or not base_url.host:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Invalid Langfuse host\"},\n        )\n\n    if base_url.userinfo:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Langfuse host must not include credentials\"},\n        )\n\n    return str(base_url)\n\n\ndef _validate_langfuse_proxy_path(endpoint: str) -> str:\n    decoded_endpoint: Final = _decode_to_convergence(endpoint)\n    if any(ord(char) < 32 for char in decoded_endpoint):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Invalid Langfuse endpoint path\"},\n        )\n    if \"\\\\\" in decoded_endpoint or decoded_endpoint.startswith(\"//\"):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Invalid Langfuse endpoint path\"},\n        )\n\n    endpoint_path: Final = \"/\" + decoded_endpoint.lstrip(\"/\")\n    if any(segment in (\".\", \"..\") for segment in endpoint_path.split(\"/\")):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Invalid Langfuse endpoint path\"},\n        )\n    return endpoint_path\n\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/vertex_ai_endpoints/langfuse_endpoints.py#L67-L103","documentation":"Path-traversal guard on the Langfuse proxy endpoint path: after decode-to-convergence (repeated URL unquoting), the path contains control characters or a '.'/'..' segment, indicating an attempt (or accident) to escape the Langfuse mount with encoded traversal sequences. The decoded path must be a plain, non-relative endpoint path.","triggerScenarios":"Thrown at litellm/proxy/vertex_ai_endpoints/langfuse_endpoints.py:85 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a valid Langfuse endpoint path; check the path for disallowed segments."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}